The browser says my site is not secure

Two different warnings

• "Not secure" beside the address. The page was loaded over plain http, without encryption. The site may have a perfectly good certificate that isn't being used, or no certificate at all.
• A full page saying "Your connection is not private", or something similar, before the site appears. The site offered a certificate and the browser rejected it. This one is more urgent, because most visitors will leave.

The five usual causes

1. The certificate has expired

   Certificates now last months rather than years, and the longest allowed is being cut further over the next few years, so renewal has to happen automatically. It fails when the domain has been pointed somewhere else, when the site moved host, or when a renewal job quietly stopped. The host can usually reissue it in minutes.

2. The certificate doesn't cover the name being visited

   A certificate lists the exact names it is valid for. One issued for example.co.uk doesn't cover www.example.co.uk unless it says so. The warning often mentions a name mismatch or an invalid common name.

3. The site is still being served over http

   A certificate exists, but nothing sends visitors to the https address. The host or a setting in the website can redirect every http request to https.

4. Mixed content

   The page itself is https, but it loads pictures, fonts or scripts over plain http. Browsers either block those or stop showing the page as secure. On WordPress, check both addresses under Settings, General start with https, and replace old http links stored in the database with a search and replace tool.

5. The visitor's clock is wrong

   If only one person sees the warning, check the date and time on their device. A certificate looks invalid to a computer that thinks it is a different year.

Checking the certificate yourself

In most browsers, click the icon to the left of the address, then the option about the connection or the certificate. It shows who issued the certificate, the dates it is valid between, and the names it covers.

If you are comfortable with a terminal, this shows the same thing without a browser in the way:

openssl s_client -connect example.co.uk:443 -servername example.co.uk </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -ext subjectAltName

Using Cloudflare

If your site is behind Cloudflare, its SSL setting matters. Flexible encrypts the connection from the visitor to Cloudflare, but not from Cloudflare to your server. It is also the usual cause of a "too many redirects" error: Cloudflare asks your server over http, the server replies "use https", and the two go round in a loop.

The setting you want is Full (strict), with a valid certificate on your server as well. Your host can install one, or Cloudflare can issue an origin certificate for the server to use.